Quality Management System Requirements For National Inspectorates
Quality Management System Requirements For National Inspectorates
Quality Management System Requirements For National Inspectorates
1
July 2019
Draft for comments
Please send any comments you may have to Dr Valeria Gigante ([email protected]), Technical Officer,
Medicines Quality Assurance, with a copy to Ms Claire Vogel ([email protected]) by 20 September 2019.
Working documents are sent out electronically and they will also be placed on the WHO Medicines
website (http://www.who.int/medicines/areas/quality_safety/quality_assurance/guidelines/en/) for
comments under the “Current projects” link. If you wish to receive our draft guidelines, please send your
e-mail address to [email protected] and your name will be added to our electronic mailing list.
7
8 © World Health Organization 2019
9
10 All rights reserved.
11
12 This draft is intended for a restricted audience only, i.e. the individuals and organizations having received this draft. The draft
13 may not be reviewed, abstracted, quoted, reproduced, transmitted, distributed, translated or adapted, in part or in whole, in any
14 form or by any means outside these individuals and organizations (including the organizations' concerned staff and member
15 organizations) without the permission of the World Health Organization. The draft should not be displayed on any website.
16
17 Please send any request for permission to:
18
19 Dr Sabine Kopp, Group Lead, Medicines Quality Assurance, Technologies Standards and Norms, Department of Essential
20 Medicines and Health Products, World Health Organization, CH-1211 Geneva 27, Switzerland, email: [email protected].
21
22 The designations employed and the presentation of the material in this draft do not imply the expression of any opinion
23 whatsoever on the part of the World Health Organization concerning the legal status of any country, territory, city or area or
24 of its authorities, or concerning the delimitation of its frontiers or boundaries. Dotted lines on maps represent approximate
25 border lines for which there may not yet be full agreement.
26
27 The mention of specific companies or of certain manufacturers’ products does not imply that they are endorsed or
28 recommended by the World Health Organization in preference to others of a similar nature that are not mentioned. Errors and
29 omissions excepted, the names of proprietary products are distinguished by initial capital letters.
30
31 All reasonable precautions have been taken by the World Health Organization to verify the information contained in this draft.
32
33 However, the printed material is being distributed without warranty of any kind, either expressed or implied. The responsibility
34 for the interpretation and use of the material lies with the reader. In no event shall the World Health Organization be liable for
35 damages arising from its use.
36
37 This draft does not necessarily represent the decisions or the stated policy of the World Health Organization.
38
39 SCHEDULE FOR DRAFT WORKING DOCUMENT QAS/19.811:
40 QUALITY MANAGEMENT SYSTEM REQUIREMENTS
41 FOR NATIONAL INSPECTORATES
During the Joint Meeting on Regulatory Guidance for Copenhagen, July 2016
Multisource Products, several WHO guidances were
identified for updating, including the Quality
Management System for National Good Manufacturing
Practise Inspectorates (WHO Technical Report Series
(TRS), No. 902, Annex 8, 2002).
Preparation of an in-depth situation analysis with regard to October 2017 – June 2018
the need for updating the guidance texts identified in the
before-mentioned meetings.
During the consultation on Good Practices for Health 10-12 July 2018
Products Manufacture and Inspection, the WHO Secretariat
presented the detailed analysis conducted on the cluster of
guidelines proposed for revision.
The Fifty-third ECSPP recommended the WHO Secretariat 22-26 October 2018
revise the Guideline Quality Management System for
Working document QAS/19.811/Rev.1
Page 3
Mailing of the revised working document for second round Mid-July – September
inviting comments, including to the EAP, and posting the 2019
working document on the WHO website for public
consultation.
Consolidation of comments received and review of feedback. End of September 2019
Preparation of working document for discussion by the
ECSPP.
42
43
44 QUALITY MANAGEMENT SYSTEM REQUIREMENTS
45 FOR NATIONAL INSPECTORATES
46
47 BACKGROUND
48
49 During the Joint Meeting on Regulatory Guidance for Multisource Products (Copenhagen, July
50 2016), several World Health Organization (WHO) guidances were identified for update. In
51 October 2016, the Fiftieth WHO Expert Committee on Specifications for Pharmaceutical
52 Preparations (ECSPP) confirmed the need to update the selected guidances.
53
54 Following up on the recommendation from the Fiftieth ECSPP, the WHO Secretariat conducted
55 a detailed analysis of the cluster of guidelines proposed for revision. The outcome of this
56 analysis was discussed during the consultation on Good Practices for Health Products
57 Manufacture and Inspection (Geneva, July 2018). In particular, considering that the WHO
58 Quality System Requirements for National GMP Inspectorates (1) defines the basic
59 requirements applicable to quality systems for the operation of inspection services within
60 national regulatory authorities (NRA) concerned with GMP inspections, the WHO Secretariat
61 proposed a strategy for revision that includes aligning the guidance with ISO 9001:2015
62 principles (2) and with Pharmaceutical Inspection Convention/Co-operation Scheme (PIC/S)
63 relevant guidance (3), as well as broadening its scope to include all GXP-related inspections
64 conducted by a NRA.
65
66 The Fifty-second ECSPP endorsed the proposal for revision and recommended the WHO
67 Secretariat to revise the WHO Quality System Requirements for National GMP Inspectorates
68 aligning its content to international standards, the latest quality management systems (QMS)
69 principles and to expanding the scope.
70
71 1. Introduction
72 2. Scope
73 3. Glossary
74 4. Quality management system
75 5. Context of the inspectorate
76 6. Management and leadership
77 7. Management system planning
78 8. Resources
79 9. Documentation
80 10. Operational planning and performance evaluation
81 11. Publications
82
83 References
84 Further reading
85
86
87 1. INTRODUCTION
88
89 1.1 This document describes the quality management system (QMS) requirements
90 for the operation of inspection services within national regulatory authorities
91 (NRA) or other state structures (for the purpose of this guidance, the term
92 “NRA” will be used in the text to represent both NRA and other state
93 structures). It is intended that each inspection service uses these requirements
94 as the basis for developing and implementing its own QMS. Where the
95 inspectorate operates under the umbrella of the NRA QMS, consideration
96 should be given to the WHO Guideline on the Implementation of Quality
97 Management Systems for National Regulatory Authorities (4).
98
99 1.2 The adoption of a common standard for QMS requirements is an essential
100 element in achieving consistency in inspection practices and facilitating
101 structured communication with other units of the NRA, as well as enabling
102 mutual confidence and permitting recognition between pharmaceutical
103 inspectorates.
104104
105 2. SCOPE
106106
107 This document outlines the QMS requirements for pharmaceutical inspectorates, competent
108 for the oversight of GXP operations.
109109
110 3. GLOSSARY
111111
112 corrective actions
113 Steps taken to eliminate the cause of existing nonconformities in order to prevent recurrence.
114 The corrective action process tries to make sure that existing nonconformities and potentially
115 undesirable situations do not happen again.
116116
117117
118118
119 good practices (GXP)
120 Acronym for the group of good practice guides governing the preclinical, clinical,
121 manufacturing, testing, storage, distribution and post-market activities for regulated
122 pharmaceuticals, biologicals and medical devices, such as good laboratory practices (GLP),
123 good clinical practices (GCP), good manufacturing practices (GMP), good pharmacovigilance
124 practices (GPP) and good distribution practices (GDP).
125125
126 internal audit
127 An examination and assessment of all or part of a quality system with the specific purpose of
128 improving it. An internal audit is usually conducted by an independent (of the function to be
129 audited) and qualified team of experts designated by the management for this purpose.
130130
131 quality indicators
132 Selected data intended to be monitored and used in assessing trends in performance.
133133
134 quality management system
135 An appropriate infrastructure, encompassing the organizational structure, procedures,
136 processes and resources necessary to ensure adequate confidence that a product (or service)
137 will satisfy given requirements for quality.
138138
139 quality manual
140 A document that includes the quality policy and objectives and describes the various elements
141 of the QMS.
142142
143 quality policy
144 A brief statement that describes the organization’s purpose, overall intentions and strategic
145 direction, provides a framework for quality objectives and includes a commitment to meet
146 applicable requirements.
147147
148148
149149
150150
151 rapid alert
152 An urgent notification submitted by a NRA participating in the Rapid Alert System concerning
153 measures taken against a product placed on the market which poses a risk to consumers’ health
154 and/or safety.
155155
156 risk management
157 The systematic application of quality management policies, procedures and practices to the
158 tasks of assessing, controlling, communicating and reviewing risk.
159159
160 standard operating procedure (SOP)
161 An authorized written procedure giving detailed instructions for performing a task or following
162 a process in accordance with legislation, official guidance or internal standards.
163163
4. MANAGEMENT SYSTEM
QUALITY
164
165
166 4.1 QMS is a wide-ranging concept which covers all matters that are necessary to
167 implement the inspectorate’s quality policy and to meet predefined objectives.
168
169 4.2 The QMS should define the inspectorate’s scope and context within the regulatory
170 mandate as well as cover all functions, processes and activities
171
172 4.3 The primary aim of an inspectorate’s QMS is as follows:
173
174 a. to ensure its ability to consistently provide services that meet the organization’s
175 objectives, as well as legal requirements and interested parties’ expectations;
176 and
177
178 b. to facilitate continual improvement and provide a sound basis for sustainable
179 development in compliance with statutory and regulatory requirements.
180 4.4
181 The QMS should at least describe and manage organizational structure,
182 responsibilities, procedures, systems, processes and resources required, to provide
value and achieve results for the inspectorate and relevant interested parties.
4.5the legal basis for the establishment of the inspectorate, its mandate, the quality policy and
Typically,
183
the184
principles of the QMS should be documented in a quality manual or equivalent document.
185
186 The QMS should enable senior (“top”) management to best use available resources
187 4.6 and systems in order to achieve the inspectorate’s targets and quality objectives.
188 Senior management’s commitment and active participation is essential to ensure
189 implementation of the QMS and to support of staff within the inspectorate.
190
191 CONTEXT OF THE INSPECTORATE
192 5.
193 The legal basis for the establishment of the inspectorate, its mandate, as well as
194 5.1 statutory and regulatory responsibilities and functions, should be clearly defined.
195
196 The inspectorate should determine its scope and its strategic direction in order to
197 5.2 achieve the intended objectives.
198
199 The structure and operation of the inspectorate should be such that impartiality
200 5.3 is safeguarded. Rules for deontology, confidentiality, ethics and conflict of
201 interest should be clearly defined and obeyed. Where relevant, the
202 inspectorate should implement a policy which distinguishes between the
203 process of inspection and that of providing an advisory service. This service
204 should be of benefit to all of industry and not solely to individual
205 organizations.
206
207 5.4 The relationship of the inspectorate with other departments within the same NRA and
208 other agencies and organizations outside the inspectorate, as well as any other
209 stakeholders, should be described and documented where relevant.
210
211 MANAGEMENT AND LEADERSHIP
212
213 6.1 Senior management should make a formal commitment to the implementation of a
214 documented quality policy that is compatible with statutory requirements and relevant
objectives.
215
216
217 6.2 Senior management should ensure that inspectorate’s services and functions are
218 aligned with regulatory requirements and NRA’s objectives, as well as meeting
219 interested parties’ expectations.
220
221 6.3 Senior management is accountable for the integration of QMS requirements into the
222 inspectorate’s processes and functions, for communicating the importance of QMS
223 principles and for the overall effectiveness of the QMS. In addition, senior
224 management should promote the application of risk management principles and
225 support the engagement and contribution of personnel in improving the QMS.
226
227 6.4 Senior management should ensure that the pharmaceutical inspectorate has sufficient
228 and appropriate resources at all levels to enable it to meet its objectives.
229 Responsibilities, authorities and reporting structure for relevant roles should be clearly
230 defined and documented in the QMS. The structure should be defined in organization
231 charts.
232
233 6.5 An appropriately experienced and qualified person should be nominated as a
234 QMS responsible person. This person should have direct access to senior
235 management. If necessary, this task may be assigned to more than one person.
236
237 6.6 There shall be a system for periodic management review of the QMS effectiveness,
238 including process improvements. Such reviews should be documented and records
239 should be maintained for a defined period.
240
241 7. MANAGEMENT SYSTEM PLANNING
242
243 7.1 The inspectorate should establish appropriate objectives for the intended level of
244 service and of its functions that should be consistent with the quality policy and
245 regulatory requirements. Risk management and sustainable development principles
246 should be considered for the establishment of these objectives.
247 7.2 These objectives should be communicated to personnel at all levels and be updated
248 whenever necessary.
249
250 7.3 Appropriate resources should be available to meet these objectives. Roles and
251 responsibilities should be defined and, where appropriate, timelines for completion
252 should be established. Systems for monitoring and evaluating results should be
253 established. The inspectorate should maintain all necessary information on quality
254 objectives.
255
256 7.4 The inspectorate should establish a documented change management system that should
257 ensure that change requests are assessed, approved or rejected, that appropriate
258 resources are allocated, and that roles and responsibilities are defined. Any change
259 should be documented, communicated to the personnel and evaluated after
260 implementation to ensure the objectives are met. The change management system
261 should ensure that continual improvement is undertaken in a timely and effective
262 manner.
263
264 8. RESOURCES
265
266 8.1 The inspectorate should have an organizational structure, required resources
267 (financial, human, facilities and others) and documented procedures that enable
268 it to meet its objectives, to perform inspection activities in accordance with
269 official GXP guidelines and national legislation and carry out its functions and
270 operations satisfactorily. Where necessary, measures and resources for the
271 safety of personnel should be available.
272
273 Personnel
274
275 8.2 The inspectorate should employ the required personnel possessing the
276 appropriate expertise to perform its functions, including inspections, and to
277 determine whether the inspected entities comply with the principles of current
278 GXP guidelines and with relevant legislation.
8.3responsible for inspections should have appropriate qualifications, training,
Personnel
279
experience
280 and knowledge of the inspection process and subject and should be periodically
evaluated.
281 They should have the ability to make professional judgements as to the conformity
of282
the inspected party with the requirements of good practices and the relevant legislation,
and
283be able to apply risk management principles in their decision-making process.
284
285 The inspectorate should ensure that induction and continuous training is provided
286 8.4 to inspection personnel on administrative, regulatory and technical topics to
287 maintain the inspectors’ competency aligned with current industry practice,
288 technological advancements and regulatory changes. Training should be
289 documented and its effectiveness assessed periodically.
290
291 The inspectorate should maintain documented and up-to-date information on
292 8.5 the relevant qualifications, training and experience of each inspector.
293
294 Personnel should have clear, up-to-date and documented job descriptions
295 8.6 specifying their duties and responsibilities.
296
297 When products are procured from a third party and/or services are subcontracted
298 8.7 to an external body or expert, the inspectorate should ensure that the third
299 party meets predefined documented criteria, qualifications and the relevant
300 requirements of the quality management system. Senior management should
301 ensure that these external bodies or experts are periodically evaluated. Third
302 party liability should be clearly defined in the contract or agreement.
303
304 All personnel employed or contracted by the inspectorate should obey the
305 8.8 inspectorate’s code of conduct and should not be subject to any commercial,
306 financial or other pressures which might affect their judgement and freedom to
307 act. They should not be under the control of the pharmaceutical industry and
308 must be assessed for potential conflict of interest. Personnel and third-party
309 declarations of conflict of interest should be maintained, reviewed periodically
310
311 and updated where necessary. It should be ensured that any decision-making
312 process remains with the inspectorate and is not influenced by any third party
313313
314 Infrastructure
315315
The 8.9
316inspectorate should provide personnel with the necessary infrastructure and appropriate
work
317 environment to support its functions and to enable meeting the quality objectives.
Infrastructure
318 includes, but is not limited to:
319
320 a. buildings, workspace, and associated facilities;
321 b. qualified equipment, including hardware and software;
322 c. transportation resources; and
323 d. information and communication technology.
324
325 9. DOCUMENTATION
326
327 9.1 The inspectorate should establish and maintain a system for the control of all
328 documentation, including electronic files, relating to inspectorate’s QMS and
329 activities. This should include policies, procedures, guidelines, records and any
330 documents of external origin, such as legislation, which may directly or indirectly
331 influence the activities of the inspectorate; or documents received from
332 pharmaceutical companies and relevant organizations, as appropriate.
333
334 9.2 The inspectorate should ensure that its functions and operations are described
335 in SOPs that clearly define the responsibilities, processes and actions. These
336 may include, but not be limited to, training, inspections, reporting after
337 inspections, handling of complaints, licensing (issue, suspension, withdrawal),
338 certification, handling of quality, safety and efficacy issues, documentation
339 control, change and deviation management, inspection planning, risk
340 management and the handling of appeals.
341
342
343 9.3 The system and activities relating to advising on, issue, withdrawal, suspension of
344 licenses, registrations, certifications and the application of other regulatory sanctions
345 on facilities, organizations, products or operations, should be detailed in procedures and
346 be in accordance with relevant guidelines and national legislation.
347347
348 9.4 The inspectorate should establish procedures describing communication with other
349 NRA units and external interested parties (e.g. industry, media) considering any
350 statutory and regulatory requirements, where appropriate. Similarly, a procedure for
351 exchanging regulatory information with other NRAs or national quality control
352 laboratories should be available.
353353
354 9.5 Activities relating to the sampling and testing of pharmaceutical products and raw
355 materials should be described in a procedure which should also include the process for
356 handling non-conforming products (e.g. substandard or falsified medical products).
357357
358 9.6 The inspectorate should have procedures on handling quality, safety and efficacy issues
359 which may lead to recall or the withdrawal of products from the market. Where
360 applicable, the inspectorate should establish and maintain a system for communicating
361 Rapid Alerts. Records of recalls and withdrawals should be maintained in accordance
362 with national legislation.
363363
364 9.7 The inspectorate should have documented procedures for dealing with complaints
365 arising from its activities or those of its personnel and any contracted person or
366 organization. A record should be maintained of all complaints received and the actions
367 taken by the inspectorate. These records should be retained for a specified period of
368 time.
369369
370 9.8 The inspectorate should have procedures for consideration of appeals against
371 its decisions.
372372
373373
374374
The 9.9
375documentation control system should ensure that:
376
377 a. Documents are identified by title, author, reviewer, approver and unique
378 identification. They should be dated and authorized by the appropriate persons
379 prior to issue.
380 b. Current versions of documents are held by nominated personnel.
381 c. A register of all relevant documents and document holders should be
382 maintained.
383 d. Superseded documents are withdrawn from use but are retained for defined
384 periods of time.
385 e. Any changes to documents are made in a controlled manner and are properly
386 authorized. There should be a means of identifying changes in individual
387 documents.
388 f. Records relating to inspectorate’s activities and functions are readily available
389 and are retained for an adequate period in line with legal requirements or
390 internal standards.
391 g. Records comply with the relevant obligations under national legislation.
392 h. Records are safely stored during their retention period and held under
393 conditions that guarantee their security and confidentiality unless otherwise
394 required by national legislation. The destruction of records after their retention
395 period follows a predefined procedure.
396 i. Electronic documentation and record management systems should provide at
397 least the same level of assurance, compliance, accuracy and security as a
398 manual system.
399
400 9.10 An inspection should be categorized in accordance with GXP guidelines (e.g. GMP,
401 GDP, GCP) and its scope (e.g. product, process) and type (e.g. triggered, routine,
402 follow-up) should be appropriately defined and documented.
403
404 9.11 The inspectorate should plan inspections in advance and elaborate a written
405 programme as part of the inspectorate’s annual workplan. Risk management
406 principles should be considered when establishing an inspection programme and
prioritizing inspections as
well
407as when conducting an inspection. Where repeated inspections of a company or organization have
to408
be carried out, the frequency should be determined based on risk management principles defined in
a procedure.
409
410
411 9.12 Inspection-related documents and records as defined in relevant inspection procedures
412 (e.g. inspection plan, aide-memoire, checklists, worksheets and company documents
413 and records) should be maintained for a defined period.
414
415 9.13 When more than one inspector is involved in an inspection, a lead inspector should be
416 appointed to coordinate inspection activities. The inspection report should be prepared
417 by the lead inspector with the assistance of all participating inspectors and/or experts
418 and should be agreed upon by all participating inspectors and or experts.
419 9.14 The inspection report should follow a pre-approved format. Observations and/or data
420 obtained in the course of inspection should be recorded in a timely manner in order to
421 prevent loss of relevant information.
422
423 9.15 The inspection report should be sent to the inspected company or organization within
424 the inspectorate’s established timelines. The lead inspector and all concerned
425 inspectors and/or experts should participate in assessing the company’s response to
426 determine the appropriateness of corrective and preventive actions as well as the GXP
427 compliance status of the company or organization.
428
429 9.16 Completed inspections should be reviewed to ensure that requirements are met.
430
431 10. OPERATIONAL PLANNING AND PERFORMANCE EVALUATION
432
433 10.1 An annual workplan should be developed, documented and periodically reviewed by
434 senior management, including all inspectorate’s activities in accordance with a written
435 procedure. Regulatory, statutory and scientific requirements should be taken into
436 account during the planning of operations and services. Consideration should also be
437 given to the availability of required resources and the ability to consistently provide
438 services that meet legislative requirements and stakeholder expectations. Risk
439 management principles should be used during planning to determine, monitor and
440 manage risks and to identify opportunities for process improvements. Any changes to
441 the workplan should follow the inspectorate’s change management system.
442
443 10.2 Appropriate quality indicators and methods should be established in order to monitor
444 and periodically evaluate the inspectorate’s processes and level of improvement and
445 service (including contracted-out services) and demonstrate that they were carried out
446 as planned and met predefined quality objectives. These quality indicators, methods,
447 analyses and results should be documented.
448448
449 10.3 The results of the analyses should be used to evaluate the performance and effectiveness
450 of the QMS, the adequacy of actions taken to address risks and the need for further
451 improvements.
452452
453 Internal Audits
454454
455 10.4 The inspectorate should implement a system of periodic and documented
456 internal audits of its operations to assess compliance with the requirements of
457 the QMS. Internal audits should be conducted at least once a year.
458458
459 10.5 Internal audit processes, criteria, scope and documents should be defined.
460 Auditors qualifications and selection criteria should be documented. Internal
461 audit records, including the findings, conclusions, recommendations and
462 follow-up actions, should be retained for a defined period.
463463
464 10.6 Corrective actions corresponding to audit findings should be identified,
465 documented and implemented in a timely manner. The effectiveness of these
466 actions should be evaluated and the risk plan should be updated to take note of
467 the root causes to the non-conformances.
468468
469469
470470
471 Management Review
472472
Senior 10.7
473 management should review the inspectorate’s QMS at planned intervals to ensure its
continuing
474 suitability, adequacy, effectiveness and alignment with the inspectorate’s strategic
direction
475 and legislative requirements. Management reviews should be conducted at least
once
476 a year.
477
478 10.8 A management review should include, but not be limited to:
479
480 a. the status of the actions from previous management reviews;
481 b. any internal or external changes affecting the QMS;
482 c. any deviations affecting the functionality of the QMS
483 d. the extent to which quality objectives have been met;
484 e. process performance analyses;
485 f. audit results and effectiveness of corrective actions;
486 g. complaints and appeals;
487 h. adequacy of resources;
488 i. any identified risks and mitigation measures; and
489 j. opportunities for improvements.
490
491 11. PUBLICATIONS
492
493 11.1 The inspectorate should issue and maintain an up-to-date list of inspected and licensed
494 facilities and organizations, including information on the outcome of inspections. This
495 list may become publicly available in accordance with national legislation.
496
497 11.2 The inspectorate should ensure that other relevant publications, such as technical
498 guides, GXP guidelines and regulatory requirements, are publicly available.
499
500
501
502
503 References
504
505 1. Quality System Requirements for National GMP Inspectorates (WHO Technical
506 Report Series, No. 902, Annex 8, 2002).
507
508 2. Quality Management Systems —Requirements. International Standard ISO 9001.
509 Geneva, International Organization for Standardization, 2015.
510
511 3. Recommendation on Quality System Requirements for Pharmaceutical
512 Inspectorates – Pharmaceutical Inspection Convention/Co-operation Scheme
513 (PIC/S) PI002-3, 2007.
514
515 4. WHO Guideline on the Implementation of Quality Management Systems for
516 National Regulatory Authorities (Working document QAS/19.783).
517